Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

NuGet repositories: push does not handle SemVer 2.0 metadata correctly #571

Open
Zastai opened this issue Feb 10, 2025 · 0 comments
Open

Comments

@Zastai
Copy link

Zastai commented Feb 10, 2025

Reproduction steps:

  • set up a hosted nuget repository
  • configure it to disable redeploy
  • push a Foo package with semver2 version 1.2.3+svn.420666.jenkins.68 (the metadata shows the SVN revision as well as the Jenkins build number)
  • push a Foo package with semver2 version 1.2.3+svn.420666.jenkins.69

Expected result:

  • the second push fails, because package Foo 1.2.3 already exists

Actual result:

  • the push succeeds and the Nexus repo has both packages in it

We do not want builds for tags (whether triggered by accident, or because of build-technical adjustments that do not affect the package contents) to change the corresponding artifact (unless we explicitly go in and delete it from Nexus first).
A NuGet server implementation is supposed to ignore that metadata when determining the package ID (for purposes like dupe checks), but yours clearly does not.
(We also don't want such a retriggered job to fail, so the push uses --skip-duplicate, but it looks that is broken as well (#463).)

Note: our CD builds have that same info, but as part of the version info (so 1.2.3-pre.svn.420666.jenkins.69, because there we do want all of them in the repo.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant